Closing EU AI Act gaps to protect ~£35M in regulatory exposure

At KPMG I was embedded as product lead on GSK's Development Data Fabric, the data backbone for clinical and development data. The EU AI Act was taking shape, and the programme carried governance and localisation gaps across regions.

Those gaps represented roughly £35M in regulatory exposure, about 7% of GSK UK revenue, and they blocked two planned regional expansions.

• Ran more than 30 discovery workshops over six months across four delivery teams, stakeholders and regions.
• Surfaced specific EU AI Act compliance gaps in data governance, PII handling and localisation.
• Landed the core insight: training-data governance needed product-level controls, not just policy documents.
• Translated regulatory requirements into concrete product and data requirements.

• Overhaul product, data governance, PII masking and localisation strategy to meet the EU AI Act.
• Treat compliance as the enabler of regional expansion, not only as risk reduction.

• Redefined data governance and PII masking across the fabric.
• Set the localisation strategy needed for regulated regional rollout.
• Mapped compliance obligations directly onto the product roadmap.

• Protected roughly £35M in regulatory exposure, about 7% of GSK UK revenue.
• Unlocked two regional product expansions, into Germany and the Netherlands.

• Regulation is a product input, best handled in discovery rather than at audit.
• In regulated programmes, governance is what makes expansion possible.
• Structured discovery at scale, more than 30 workshops, turns ambiguity into a defensible plan.